# tadghyelmehdi/ids-ips-system architecture

> Architecture diagram of the GitHub repository tadghyelmehdi/ids-ips-system, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tadghyelmehdi/ids-ips-system
- Repository: https://github.com/tadghyelmehdi/ids-ips-system

## Overview

This is an IDS/IPS system: captured network traffic is aggregated into flow features, submitted to the Flask prediction endpoint, and evaluated for attacks before firewall action and audit logging. The backend also serves dashboard data and Telegram alerts; model training is a separate capability. The README documents whitelist bypass and the dashboard’s live views. Some backend internals and the Flutter client are unsampled, so their connections are omitted or marked unverified.

Main entry points: [`app.py`](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py) (Security Engine), [`capteur.py`](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/capteur.py) (Flow Sensor), [`flutter_dashboard/lib/main.dart`](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/flutter_dashboard/lib/main.dart) (Flutter Dashboard), [`rf_model.py`](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/rf_model.py) (Model Trainer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Traffic Capture"]
  node_sensor["Flow Sensor<br/>[capteur.py]"]
end

subgraph group_detection["Detection and Response"]
  node_engine["Security Engine<br/>[app.py]"]
  node_whitelist["Whitelist Fast Path<br/>[app.py]"]
  node_ml["ML and Heuristics<br/>[app.py]"]
  node_firewall["Firewall Control<br/>[app.py]"]
  node_telegram["Telegram Alerts<br/>[app.py]"]
  node_audit[("SQLite Audit Log<br/>[app.py]")]
end

subgraph group_interface["Dashboard and API"]
  node_api["Flask API<br/>[app.py]"]
  node_dashboard["Web Dashboard<br/>[app.py]"]
  node_flutter["Flutter Dashboard<br/>[main.dart]"]
end

subgraph group_training["Model Training"]
  node_trainer["Model Trainer<br/>[rf_model.py]"]
end

node_traffic(("Network Traffic"))
node_operator(("Dashboard Operator"))

node_traffic -->|"captures"| node_sensor
node_sensor -->|"submits features"| node_api
node_api -->|"calls prediction"| node_engine
node_engine -.->|"checks bypass"| node_whitelist
node_engine -->|"classifies flows"| node_ml
node_engine -->|"blocks IPs"| node_firewall
node_engine -->|"sends alerts"| node_telegram
node_engine -->|"writes events"| node_audit
node_api -->|"serves page"| node_dashboard
node_dashboard -->|"polls data"| node_api
node_operator -->|"views alerts"| node_dashboard
node_operator -->|"requests unblock"| node_api
node_flutter -.->|"uses backend"| node_api
node_trainer -.->|"produces model"| node_ml

click node_sensor "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/capteur.py"
click node_api "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_engine "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_whitelist "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_ml "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_firewall "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_telegram "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_audit "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_dashboard "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py"
click node_flutter "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/flutter_dashboard/lib/main.dart"
click node_trainer "https://github.com/tadghyelmehdi/ids-ips-system/blob/main/rf_model.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sensor toneBlue
class node_engine,node_whitelist,node_ml,node_firewall,node_telegram,node_audit toneAmber
class node_api,node_dashboard,node_flutter toneMint
class node_trainer toneRose
class node_traffic,node_operator toneIndigo
```

## Components

### Traffic Capture

- [Flow Sensor](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/capteur.py): `capteur.py`

### Detection and Response

- [Security Engine](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [Whitelist Fast Path](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [ML and Heuristics](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [Firewall Control](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [Telegram Alerts](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [SQLite Audit Log](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`

### Dashboard and API

- [Flask API](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [Web Dashboard](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/app.py): `app.py`
- [Flutter Dashboard](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/flutter_dashboard/lib/main.dart): `flutter_dashboard/lib/main.dart`

### Model Training

- [Model Trainer](https://github.com/tadghyelmehdi/ids-ips-system/blob/main/rf_model.py): `rf_model.py`

### Other components

- **Network Traffic**
- **Dashboard Operator**

## Connections

- Network Traffic → Flow Sensor: captures (evidence: `README.md`)
- Flow Sensor → Flask API: submits features (evidence: `capteur.py`)
- Flask API → Security Engine: calls prediction (evidence: `app.py`)
- Security Engine → Whitelist Fast Path: checks bypass (evidence: `README.md`)
- Security Engine → ML and Heuristics: classifies flows (evidence: `app.py`)
- Security Engine → Firewall Control: blocks IPs (evidence: `app.py`)
- Security Engine → Telegram Alerts: sends alerts (evidence: `app.py`)
- Security Engine → SQLite Audit Log: writes events (evidence: `README.md`)
- Flask API → Web Dashboard: serves page (evidence: `app.py`)
- Web Dashboard → Flask API: polls data (evidence: `app.py`)
- Dashboard Operator → Web Dashboard: views alerts (evidence: `README.md`)
- Dashboard Operator → Flask API: requests unblock (evidence: `app.py`)
- Flutter Dashboard → Flask API: uses backend
- Model Trainer → ML and Heuristics: produces model (evidence: `README.md`)